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Abstract 

Aircraft engines can be effective actuators to help pilots avert or recover from emergency situations. Emergency 
control modes are being developed to enhance the engines’ performance to increase the probability of recovery 
under these circumstances. This paper discusses a proposed implementation of an architecture that requests 
emergency propulsion control modes, allowing the engines to deliver additional performance in emergency 
situations while still ensuring a specified safety level. In order to determine the appropriate level of engine 
performance enhancement, information regarding the current emergency scenario (including severity) and current 
engine health must be known. This enables the engine to operate beyond its nominal range while minimizing overall 
risk to the aircraft. In this architecture, the flight controller is responsible for determining the severity of the event 
and the level of engine risk that is acceptable, while the engine controller is responsible for delivering the desired 
performance within the specified risk range. A control mode selector specifies an appropriate situation-specific 
enhanced mode, which the engine controller then implements. The enhanced control modes described in this paper 
provide additional engine thrust or response capabilities through the modification of gains, limits, and the control 
algorithm, but increase the risk of engine failure. The modifications made to the engine controller to enable the use 
of the enhanced control modes are described, as are the interaction between the various subsystems and importantly, 
the interaction between the flight controller/pilot and the propulsion control system. Simulation results demonstrate 
how the system responds to requests for enhanced operation and the corresponding increase in performance. 


Nomenclature 


Accel 

Acceleration Limit (rpm/s) 

Alt 

Altitude (ft) 

C-MAPSS40k 

Commercial Modular Aero Propulsion System Simulation 40k 

CMS 

Control Mode Selection and Risk Management 

EPR 

Engine Pressure Ratio 

HPC 

High Pressure Compressor 

Nc 

Core Speed (rpm) 

W 

Fan Speed (rpm) 

Pxx 

Pressure at Station xx (psia) 

PI 

Proportional-Integral controller 

PLA 

Power Lever Angle 

Ps3 

Compressor Discharge Static Pressure (psia) 

RU 

Ratio Unit Limiter 

Txx 

Temperature at Station xx (°R) 
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I. Introduction 


The ability of an aircraft to use its engines to avert or recover from emergency situations is being investigated. 
The focus is on two general types of emergencies: (1) runway incursion, and (2) rudder/tail failures. In the runway 
incursion scenario, the aircraft’s available takeoff distance is suddenly decreased; this can be due, for instance, to an 
object entering the runway in the plane’s path. The availability of additional contingency thrust may enable safe 
takeoff in a shortened distance because the aircraft would reach takeoff speed sooner, thus averting disaster (Ref. 1). 

The rudder/tail failure scenario encompasses such problems as stuck or broken actuators, airframe damage, and 
damaged or missing flight control surfaces. Previous piloted studies (Refs. 2 and 3) with simulated total hydraulic 
failure demonstrated that landing an aircraft using only the throttles to maneuver the aircraft is extremely difficult 
due to the slow engine response times and the inability to damp out the phugoid and dutch roll modes. For this type 
of emergency situation, increasing the responsiveness of the engines in order to counter the phugoid and dutch roll 
modes is the primary goal. 

Both of these scenarios assume that the flight control can request additional performance from the engines. This 
requires a more tightly coupled flight and propulsion control system, and that the normal restrictions on engine 
performance for life and operability assurance be relaxed. In current aircraft, the pilot integrates the flight and 
propulsion systems manually though manipulation of the cockpit controls (“stick and rudder”) for maneuvering and 
throttle for thrust. In order to provide a more integrated approach that enables the propulsion system requirements to 
be set by the flight control system, a new flight control/engine control architecture must be implemented to allow for 
more information flow between the two systems. With the condition that the engine performance can be modified by 
the flight control system, the notion of risk management is introduced. A risk management architecture for enhanced 
engine operation is shown in Figure 1 (Ref. 4). In Figure 1, the pilot command (dashed) to the Engine Controller is 
diverted to the Enhanced Flight Control block which is connected to the Engine Controller. The architecture allows 
the flight control side to interact with the propulsion system in two ways. First, it can modify the engine controller 
directly to enable enhanced operation, as will be discussed below. Second, it can command thrust through the 
Enhanced Flight Control block to enable more coordinated use of the engines as flight control effectors. This type of 
integrated flight and propulsion control system augments the pilot’s interaction with the engine. The use of 
contingency thrust for runway incursion mitigation, symbolized by the idea of a virtual beyond maximum throttle, is 
the simplest implementation of this integrated mode. 

In this proposed risk management architecture, the flight control side is responsible for identifying the type of 
upset condition, e.g., airframe damage or obstruction in the runway, and the severity of the condition, and 
determining the engine performance requirement and the corresponding risk of engine failure that is acceptable. The 
engine control side is responsible for implementing the enhanced control mode to achieve the required response 
within the specified risk range or, if infeasible, reporting back what is achievable, and carrying out the command 
from the pilot and/or flight control system. Additionally, in a multi-engine aircraft, the flight controller must 
coordinate the enhancement of the engines’ performance to avoid creating an asymmetric thrust situation or other 
dangerous conditions that can arise as a result of the enhancement; these situations are beyond the scope of this 
paper since they are airframe integration issues. A detailed explanation of this proposed architecture may be found 
in Reference 4; some specifics of the implementation relative to this work are described below. 

The Engine and Controller subsystem in Figure 1 is represented by the Commercial Modular Aero-Propulsion System 
Simulation 40k (C-MAPSS40k), a 40,000 lb thrust class, two spool, physics-based, component level, high bypass turbofan 
engine simulation and closed loop controller written in the MATLAB/Simulink (The MathWorks, Inc.) environment 
(Ref. 5). The C-MAPSS40k simulation contains a representative commercial aircraft engine controller (Ref. 6), which will 
be summarized in Section III of this paper. 

The Control Mode Selector and Risk Management subsystem modifies the nominal engine controller to initiate 
“enhanced control modes.” These modes are designed and tuned off-line based on the risk of the modifications. The 
implementation of greater than nominal thrust is handled via the “overthrust” enhanced control mode. To increase 
the speed of the engine’s response to throttle commands, three different control modes are combined by the control 
mode selector: (1) increased controller bandwidth, (2) increased allowable core shaft acceleration, and (3) high 
speed idle. Each of these control modes has a different effect based on the current flight condition as well as the 
operational state of the engine. The implementation and details of each of these control modes will be discussed in 
Section III. 
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Figure 1 . — Proposed risk management architecture for enhanced operation (adapted from Ref. 4). In the 
proposed architecture, the pilot command (dashed) to the Engine Controller is diverted to the Enhanced 
Flight Control block which is connected to the Engine Controller. 


This paper focuses on the implementation of a proposed risk management architecture in the C-MAPSS40k 
simulation and the integration of enhanced engine modes. The enhanced control modes do not require any new 
actuators, rather they change engine control limits, change controller protection logic, and modify existing actuator 
inputs. Section II discusses the control mode selection and risk management subsystem. Section III describes both 
the nominal and enhanced engine control laws, and the engine life and operability prognosis subsystem is described 
in Section IV. A brief discussion of the pilot and flight control subsystems can be found in Section V. Section VI 
focuses on simulation results, and a summary can be found in Section VII. 


II. Control Mode Selection and Risk Management 

The Control Mode Selection and Risk Management (CMS) subsystem is responsible for ensuring that the engine 
provides the desired response within the specified risk range. The CMS system acts as a supervisor and coordinator 
of the propulsion control system by communicating with all the necessary subsystems to provide the enhanced 
performance as shown in Figure 2. The CMS receives information including the type of enhanced control required 
(overthrust, fast response, or both), flight condition, and acceptable risk from the flight control system. The 
acceptable risk indicates how aggressive the control mode selector can be in extending the current engine limits. The 
CMS provides the flight control with an estimate of the engine’s performance capability to allow the flight controller 
to update the performance request if required. The CMS evaluates each engine on a multi-engine aircraft 
independently; the flight controller coordinates the overall propulsion control enhancement based on the situation 
and each engine’s capabilities. 
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Figure 2. — The interaction of the control mode selection and risk management subsystem with the proposed risk 
management architecture. 


In Reference 7, the risk of engine failure as a function of the time and amount of requested overthrust operation 
was quantified; increasing the operating time increased the risk of failure. Therefore, the flight controller is 
responsible for determining the expected duration for the requested additional power. In a case where the additional 
thrust is requested for takeoff, the flight controller may select a short duration, say 15 min, which anticipates a need 
for maintained excess power while the aircraft clears the runway and ground effect, into climb and includes a safety 
margin since the actual time to clear the ground effect and climb is less than 15 min. Alternately, when additional 
thrust is required to overcome excessive drag due to airframe damage, the flight controller may request additional 
thrust for 90 min, a worst case time estimate required to land at the nearest airport in the continental United States 
from the current position. Allowing the flight controller to only select a few discrete time durations (short: less than 
15 min, medium: less than 45 min, or extended: less than 90 min) greatly simplifies the communications and 
maintains somewhat conservative operation since the time estimate used in the risk calculation is greater than 
necessary. 

The CMS implements changes in the engine control by modifying the engine limits, controller bandwidth, and 
the protection logic. To determine the engine limits, the CMS passes information regarding the flight condition and 
acceptable risk to the Engine Life and Operability Prognosis subsystem. The Engine Condition Monitoring 
subsystem contains health management algorithms and life usage algorithms that determine the remaining engine 
life and operating margins. The Engine Life and Operability Prognosis subsystem, discussed in Section IV, 
computes the risk of activating a proposed control mode given the current conditions and state of the engine. Based 
on this query of the Engine Life and Operability Prognosis subsystem and concurrence from the flight controller, the 
CMS initiates modification of the engine controller’s limits and implements the desired enhanced control mode. 
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III. Engine and Controller Subsystem 

The engine and controller subsystem is responsible for providing the additional engine performance in a way that 
ensures operation below the specified risk level. The interaction of the engine and controller subsystem is shown in 
Figure 1. This section discusses the changes made to the engine controller. 

The C-MAPSS40k simulation package contains a representative commercial aircraft engine controller (Ref. 6), 
which is shown in Figure 3. The engine controller is divided into two sections, the Power Management controller 
and Protection Logic controller. The power management controller is responsible for providing (1) the requested 
thrust and (2) an acceptable response (highest bandwidth possible with no overshoot) when transitioning from one 
thrust level to another. The amount of thrust produced is determined by converting the throttle position from the 
pilot to a controlled engine variable, typically Engine Pressure Ratio ( EPR ) or fan speed ( NJ ); C-MAPSS40k uses 
EPR. The conversion from throttle position to controlled variable is carried out by the setpoint function. When 
transitioning from one thrust level to another, the setpoint controller ensures that the engine does not exceed the 
desired value. The protection logic controller is responsible for ensuring that the engine does not violate any of its 
physical or operational limits. The limits of concern are the maximum rotor speeds, Nf max and Nc max', combustor 
pressure limits, Ps3 min and Ps3 max', acceleration limit, Accel', and a Ratio Unit limit, RU min. Reference 6 
contains a detailed description of the structure and function of the nominal control system found in C-MAPSS40k. 
In order to determine the effect of modifying the various limits in the nominal controller, a sensitivity study has been 
performed (Ref. 7). The results of the study led to the selection of the various enhanced control modes. A summary 
of the modifications required to enable the enhanced control modes for both overthrust and faster engine response 
(FastER) based on the results of the sensitivity study is found below. 




Figure 3. — C-MAPSS40k closed loop control system. 
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A. Overthrust Operation 

In order for the engine to produce additional thrust, there are several modifications made to the engine control 
system. First, the setpoint function has to be extended beyond the current designed thrust level. To do this the tables 
that describe the engine pressure ratio (EPR) and fan speed ( Nf) setpoints based on throttle position or Power Lever 
Angle (PLA) are linearly extrapolated out to 120 percent of maximum power. This also requires extending the 
C-MAPSS40k throttle limit from 80° to 90°, where 90° correlates to 120 percent maximum power. The pilot would 
indicate that the emergency control mode is initiated and the setpoint commands to the engines would adjust to the 
appropriate values. To avoid a potential thrust asymmetry, these setpoints would be determined individually by the 
flight controller. 

Next, the nominal control logic might need to be altered. The protection logic controller is designed to prevent 
the engine from exceeding any of its physical and/or safety limits, which may constrain the additional thrust 
produced by the engine. From Reference 7, the engine is capable of producing additional thrust without extending 
the current engine limits, but it is often less than the 120 percent maximum power thrust sought. To allow the flight 
controller/pilot to determine the maximum thrust, logic is added to the individual control limiters to allow the CMS 
system to modify their limits in real time. 

The results of the sensitivity study showed that even with the nominal safety and operability limits in place, the 
risk of engine failure during overthrust can be unacceptably high due to an increase in the turbine temperatures. The 
turbine temperatures are typically not automatically controlled in commercial aircraft engines; therefore, to be able 
to produce additional thrust while minimizing the risk of failure, a turbine temperature limiter is added to the 
protection logic controller that will be activated only in emergency scenarios. The temperature limiter added to 
C-MAPSS40k is an exhaust gas temperature (T50) limiter, as that is the only temperature sensor found in the hot 
section of the engine. 

B. Faster Engine Response 

In this implementation there are three modifications made to the controller to increase the responsiveness of the 
aircraft engine. They address different types of throttle changes, so their impact depends on the way the engine is 
used. The first modification is to increase the bandwidth of the setpoint controller. This is accomplished by 
increasing the integrator term of the proportional-integral (PI) controller by a value determined by the control mode 
selector. The sensitivity study determined that the integrator term can be safely increased by a factor of up to 1.6 
without causing unacceptable loss of stability margins (Ref. 7). 

The second modification made to the engine controller is to add an offset to the acceleration schedule. This 
allows a faster response to large throttle transients, which are mainly limited by the acceleration schedule, at the cost 
of decreasing the minimum high pressure compressor (HPC) surge margin. This offset must be determined as a 
function of the flight condition, engine health estimate, and the desired minimum surge margin. The desired 
minimum surge margin is determined by the control mode selector based on the risk level the flight controller is 
willing to accept. The closer the minimum surge margin is to zero, the greater the risk that this engine will surge. 

The final modification to increase the responsiveness of the engine is to implement a control mode known as 
High Speed Idle (HSI) (Ref. 8). High Speed Idle is an enhanced control mode that is only active when the pilot has 
the throttle near the Flight Idle setting — typically used on approach and landing. When in flight idle the engine is 
operating at very low power, with correspondingly low fan and core shaft speeds. These low speeds inhibit rapid 
acceleration because of the large difference in the fan and core inertias, resulting in shaft acceleration mismatch that 
can lead to HPC surge. The idea of this control mode then is to force the engine to operate at a higher internal power 
setting while still producing the low level of thrust the pilot needs to land. By maintaining higher flight idle shaft 
speeds, the engine can accelerate more quickly than a nominal engine, regardless of the size of the throttle transient, 
age of the engine, ambient conditions, etc. In order to maintain the nominal thrust level, the HSI control mode 
modifies the HPC inlet variable stator vane angle, the customer bleed, and the idle setpoint. More information 
regarding this control mode can be found in References 7 and 8. 


IV. Engine Life and Operability Prognosis 

The extent to which engine limits can be adjusted while ensuring that the acceptable risk level is not exceeded is 
determined by the current condition of the engine. Various blade speeds, component temperatures, and the overall 
component deterioration levels must be factored into the risk calculation (Ref. 9). Depending on the requested 
enhancement, the prognosis system will use different methods to calculate risk: the overthrust mode requires 
calculations based on steady state turbine blade characteristics, while the faster engine response mode depends upon 
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available surge margin and the transient-related reduction. In the case of overthrust, the engine is exposed to harsh 
temperatures and speeds necessitating that the life of individual components be tracked to avoid catastrophic failure. 
Within the prognosis system there is a database of engine characteristics to compute the expected turbine blade life 
based on stress and temperature. The lives of a population of similar parts subjected to the same conditions will vary 
according to a distribution. Assuming that component life is probabilistic, the combined risk for many parts can be 
quantified into a single tangible risk distribution. The Weibull distribution is a continuous probability distribution 
used to calculate the risk of failure versus time. By combining risk distributions for various failure modes and 
operating conditions, it is possible to determine whether the overall risk is within the specified range. 

For a faster engine response, the potential for HPC surge becomes the foremost issue. Engines are normally 
operated well below their surge line to account for worst case uncertainty in destabilizing influences while still 
ensuring safety. In order to be able to increase engine response aggressively, this safety surge margin must be 
reduced. By accounting for random and systematic variances, it is possible to estimate the current engine surge 
margin to within some degree of error (Ref. 10). This improved knowledge allows limits to be set closer to engine 
surge with high confidence that the engine will continue to operate with steady flows even during transients. 

Using the life prognosis subsystem, it is possible to calculate the risk of operating in a desired state for a given 
time based on the current engine state. The interaction between the CMS and the Engine Life and Operability 
Prognosis Subsystem should result in obtaining controller limits that guarantee that a maximum level of risk will not 
be exceeded. To avoid time-consuming and computationally intensive iterations during a crucial time, in this 
implementation lookup tables were generated. For these tables, data are pre-saved at multiple trim points throughout 
the flight envelope, and scheduled across four dimensions: risk, altitude, temperature, and engine life. Due to the 
high non-linearity of risk, these tables require many interpolation points in every dimension. In order to reduce the 
size of these tables, the risk dimension is limited to a few discrete levels. This method is adequate under the 
assumption that the acceptable risk provided by the flight controller will always be relatively inexact. When creating 
the risk tables, the risk is rounded up to the closest predetermined risk level, resulting in additional conservatism. 
This combination of discrete risk levels and look-up tables allows engine limits to be calculated with a single series 
of interpolations. 


V. Pilot and Flight Control 

There are many viewpoints on the interaction between pilot and flight controller in an emergency. For the 
purposes of this work, it is assumed that the pilot initiates the automatic restructuring of the control system to enable 
enhanced engine operation. Consider the runway incursion emergency. In this situation, while the aircraft is 
approaching takeoff speed, the pilot notices or is notified of an obstruction in the runway. If the pilot determines that 
stopping or turning to avoid the obstacle is not viable options, he/she could, for instance, press an EMERGENCY 
switch, alerting the flight control system that there is an emergency. Since the flight controller is aware that the 
aircraft is on the runway attempting to take off, the flight controller indicates to the control mode selector to enter 
the overthrust control mode and to allow the pilot to command additional performance for a short duration, 
sufficient to enter climb, and below a determined risk level. The engine control system will then update to provide 
the additional performance, in accordance with the specified acceptable risk level, allowing the pilot to move the 
throttle to a higher power setting and clear the obstruction. 

The rudder/tail failure scenario is a little more complicated. After airframe, flight control surface, or actuator 
damage, maneuverability might be severely degraded. In this situation, either the flight controller identifies and 
isolates the problem with the airframe and notifies the pilot, or the pilot notices that the handling capabilities have 
suddenly changed dramatically. If the loss of maneuverability is significant enough, the pilot may need to use the 
engines as additional flight control actuators. In this case, the pilot presses the EMERGENCY switch to request 
additional performance from the engine. The flight controller analyzes the situation, determines that that the engine 
responsiveness needs to increase, determines the engine risk level that the aircraft is willing to accept, and passes the 
information to the control mode selector. Again, the CMS will get the current state of the engine from the Life and 
Operability Prognosis subsystem and command new control limits and/or logic changes. This will result in the 
engines responding faster to the pilot’s commands, giving the pilot a better chance to land the plane safely. 
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VI. Simulation Results 


To demonstrate how the enhanced control operation works, the engine control system enhanced operation 
functions are implemented in the C-MAPSS40k closed loop engine simulation. A block diagram of this controller 
architecture is shown in Figure 4. The inputs to the control mode selector simulation are assumed to be the actual 
outputs from the flight controller: the type of enhanced control mode, acceptable risk level, and flight condition. 

To frilly test this architecture, both a runway incursion and rudder/tail failure emergency scenario will be 
simulated. First consider the runway incursion scenario. In this simulation, the pilot will identify the situation and 
indicate it by pressing the EMERGENCY switch at 10 sec into the run. This causes the flight controller to determine 
that there is an obstruction on the runway, request additional thrust, and specify the maximum risk level and the 
approximate time the additional thrust is requested for. The pilot indicates that the engine setpoint is to move past 
the maximum power setting (PLA = 80) to maximum emergency full power thrust (PLA = 90), which in this 
implementation is up to 120 percent full power. Note that the required thrust is dictated by the situation and the 
available thrust is limited by the acceptable risk, so the maximum may not reach 120 percent hill power. An engine 
response for each of four different levels of acceptable risk is shown in Figure 5. This scenario depicts an aircraft 
with an end of life engine (severely deteriorated) taking off from Denver International Airport (altitude of 5,431 ft 
above sea level), which is a worst case take-off scenario. 
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Figure 4. — CMS and engine controller interaction implemented in C-MAPSS40k. 
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Figure 5. — Overthrust engine response for an end of life engine at 5,431 ft elevation, 
0.17 Mach, at standard day temperature for different levels of acceptable risk 
(shown in legend). 


Figure 5 shows that increasing the acceptable risk increases the thrust produced by the engine and 
correspondingly increases the other engine variables. For an acceptable risk level of 5 percent, only the nominal 
turbine temperature limit (1500 °R) is violated, however increasing the acceptable risk to 10 percent or greater, the 
fan speed also violates its limit. With increased engine outputs and risk, the thrust output also increases. 

Now consider an approach scenario with a damaged airframe where at a time of 20 sec the pilot executes the 
emergency control mode. After pressing the EMERGENCY switch, the pilot moves the throttle from a flight idle 
position (43°) up to 50°. The engine response compared to the nominal engine response is shown in Figure 6. The 
engine response for the same scenario, but a throttle input from flight idle to maximum power is shown in Figure 7. 
Figures 6 and 7 depict an aircraft approaching JFK International Airport in New York (which is at an elevation of 
13 ft above sea level). In this situation the aircraft is 2,000 ft above the runway. 

In the simulations shown in Figures 6 and 7, at a time of 20 sec the high speed idle control mode is activated 
since an emergency situation has been detected and the engine is near flight idle. When High Speed Idle is initiated, 
there is an increase in the core speed and exhaust gas temperate ( T50 ) and a decrease in the HPC surge margin, as 
shown in both figures. The improvement with the enhanced operation is greater in Figure 7 than that shown in 
Figure 6 due to the fact that, with the nominal control, a large throttle transient encounters more limits than a small 
transient. Thus there are more potential controller modifications available to improve the response to a large throttle 
transient. For the smaller throttle transient (Fig. 6), the PI gain modification and the high speed idle control mode 
affect the engine response. For the larger throttle transient (Fig. 7), the PI gain modification, the high speed idle 
control mode, and the acceleration schedule modification affect the engine response. 
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Figure 6. — Enhanced operation compared to the nominal response for a new 
engine at 2,013 ft above sea level (2,000 ft above the runway), 0.26 Mach, at 
standard day temperature for a small throttle transient (7°) starting at flight idle. 
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Figure 7. — Enhanced operation compared to the nominal response for a new engine 
at 2,013 ft above sea level (2,000 ft above the runway), 0.26 Mach, at standard 
day temperature for a large throttle transient from flight idle to full power. 
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VII. Summary 

This paper focused on one implementation of a control architecture intended to increase the performance of 
aircraft engines under emergency scenarios. In order to increase the survivability of the aircraft in some situations, it 
may be necessary to overstress the engines to obtain additional thrust or increase their responsiveness to the pilot’s 
throttle command. In this new architecture, the flight controller is tasked with analyzing the aircraft’s situation and 
determining engine requirements with a corresponding maximum risk the engine should incur. The engine control 
system is responsible for determining the current state of each engine (life and health), determining how to extend 
the engine limits to maximize performance for the risk level determined by the flight controller, and for producing 
the additional performance without exceeding the acceptable risk level. The engine control system functions have 
been integrated with a version of the Commercial Modular Aero-Propulsion System Simulation 40k and the flight 
control system commands have been added as inputs to the simulation to illustrate the concept. 
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